fix: allow multiples values in the secretResourceNames slice

traefik · Jun 19, 2024 · 24978e8 · 24978e8
1 parent b159d48
commit 24978e8
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 2 deletions.
diff --git a/traefik/templates/rbac/clusterrole.yaml b/traefik/templates/rbac/clusterrole.yaml
@@ -37,8 +37,8 @@ rules:
       - ""
     resources:
       - secrets
-    {{- if gt (len .Values.rbac.secretResourceNames) 0 }}
-    resourceNames: {{ .Values.rbac.secretResourceNames }}
+    {{- with .Values.rbac.secretResourceNames }}
+    resourceNames: {{ toYaml . |nindent 6 }}
     {{- end }}
     verbs:
       - get

diff --git a/traefik/tests/rbac-config_test.yaml b/traefik/tests/rbac-config_test.yaml
@@ -581,6 +581,26 @@ tests:
               - get
               - list
               - watch
+  - it: ClusterRole should allow get, list, watch access only to multiple secrets listed in secretResourceNames if not empty
+    set:
+      rbac:
+        secretResourceNames: [traefik-tls-cert, some-other-cert]
+    asserts:
+      - template: rbac/clusterrole.yaml
+        contains:
+          path: rules
+          content:
+            apiGroups:
+              - ""
+            resources:
+              - secrets
+            resourceNames:
+              - traefik-tls-cert
+              - some-other-cert
+            verbs:
+              - get
+              - list
+              - watch
   - it: Role should allow get, list, watch access to every secret if secretResourceNames is empty
     set:
       rbac: